Unlike Shopify, WordPress doesn't ban cannabis content outright - it's actually the platform most cannabis websites get built on, mainly because of how many free and paid themes and plugins exist for it. Joomla is usable too, though there are far fewer cannabis-specific templates for it. So the pitch makes sense on the surface: familiar tools, no policy standing in the way, why not build the storefront there.
What "just use WordPress" actually means
A marketing page is one thing. A working storefront that takes real orders is a different project, and on WordPress or Joomla it isn't one plugin - it's several, from several vendors, none of which were built to work together:
- An age-verification plugin, bolted on separately from the checkout it's supposed to protect
- An e-commerce plugin - WooCommerce on WordPress, VirtueMart or HikaShop on Joomla - to actually take orders
- A specialised payment processor, because mainstream ones like PayPal and Authorize.net don't support cannabis sales regardless of which CMS is underneath
- Cannabis-friendly hosting, since general-purpose hosts can still apply their own restrictions even when the CMS itself has no policy against it
That's four separate vendor relationships before the storefront can take a single order - and none of them know about your actual till, your actual stock count, or the loyalty points a customer already has from buying in-store.
The part that doesn't show up until later
WooCommerce, VirtueMart, and HikaShop are web storefronts. They have no idea what's happening at the counter. A product sold online and a product sold in-store are tracked in two different places unless someone builds a bridge between them - which means either double-counting stock, or a manual reconciliation step at the end of every day to make sure the website and the till agree on what's actually left on the shelf.
Each plugin in that stack also needs its own updates, and WordPress plugin vulnerabilities are a well-documented, ongoing security category on their own - a storefront assembled from five separate plugins carries five separate sets of update and security obligations, indefinitely.
What one system removes
None of this is a reason WordPress or Joomla are bad tools - they're not, for what they're built for. It's that a cannabis retailer isn't actually shopping for a CMS. They're shopping for a till, a storefront, age verification, and stock tracking that agree with each other by default, because they're the same system rather than four plugins from four vendors that happen to be installed on the same site.
Related reading
See how Budstack handles this
Fifteen minutes, a walkthrough of the platform, and a number scoped to the stores you actually run.